Code Quality — Playbook

In a nutshell

Code Quality stops reliability and maintainability problems from becoming tomorrow's technical debt.

It combines CodeQL rules + AI-assisted analysis, suggests fixes in pull requests, measures repository health, and can block merges that miss your quality bar.

What Code Quality covers 📖 Docs

Generally available since July 20, 2026. Its job is to keep code reliable, maintainable, and covered by tests as it ages. It is a standalone product that sits next to GitHub Advanced Security, not a feature bundled inside it.

▸ PICK A TOPIC. THE SECOND TAB IS CODE SCANNING, FOR REFERENCE

Code Quality Code ScanningREF

Primary goal

Keep the code reliable and maintainable: safer refactors, lower maintenance cost, a cleaner codebase.

Catch security vulnerabilities and coding errors before they reach production.

Typical finding

Two families. Reliability: duplicate if condition, unreachable statement, off-by-one against length, missing error check, uninitialized variable. Maintainability: useless assignment, expression with no effect, database query in a loop.

SQL injection, XSS, path traversal, unsafe data flow.

Analysis engine

CodeQL quality rules, plus AI-assisted detection for patterns no fixed rule covers.

CodeQL security queries, or any third-party tool that uploads SARIF.

AI findings

Same quality goals as Standard findings: reliability and maintainability, without predefined rules and across all languages. Runs after merge on recently changed files on the default branch, not on PRs. Results appear under AI findings. Docs ↗

AI Scan detects security vulnerabilities on PR changes only, in selected languages and frameworks not covered by CodeQL, such as PHP, Bash, HCL, Dockerfiles, JSP and Blazor. No full-repository scan or backlog alerts. Docs ↗

Reporting

Standard findings land in two places: bot comments on the pull request, and the repository Security tab for the default branch. Each one is graded Error / Warning / Note, and those grades drive the quality score.

Alerts are graded by severity and CWE, and aggregated in Security overview.

Merge control

Quality and coverage thresholds in rulesets, with an evaluate mode to measure the impact before enforcing.

Code scanning checks and security merge protection.

Query coverage

Standard queries: C# 69, Go 22, Java/Kotlin 89, JS/TS 98, Python 101, Ruby 3, Rust 1. 383 in total. C/C++, Swift and Actions are not covered yet.

Default queries: Actions 18, C/C++ 61, C# 59, Go 36, Java/Kotlin 80, JS/TS 89, Python 45, Ruby 44, Rust 36, Swift 29. 497 in total, of which 413 raise alerts.

SELECT A TOPIC ▸

🔑 Use both: Code Scanning protects against exploitable risk; Code Quality protects long-term code health.

Language support 📖 Docs

Rule-based CodeQL analysis covers 6 languages only: C#, Go, Java, JS/TS, Python, Ruby. C/C++, Swift and the rest get AI analysis and coverage, nothing more.

Feature	✅ 6 CodeQL languages	⚠️ C/C++ and others
🔍 CodeQL findings + Autofix on PRs	✅	❌
📋 Standard findings on the default branch	✅	❌
🤖 Agentic Autofix	✅	❌
🚧 Quality gate on findings	✅	❌
🧠 AI analysis (recently changed files)	✅	✅
🧪 Coverage (Cobertura XML)	✅	✅

💡 Only CodeQL findings show up on pull requests. For C/C++ PR reviews, add Copilot code review ↗ (a separate product).

Catch issues before merge

When AI writes most of the code, a ruleset quality gate on every PR is what holds the bar. GitHub’s teams fix 67.3% of findings before merge (GitHub, 2026 ↗).

	🟢 Gate on every PR	🔴 No gate
🤖 Agent	Its blind spots get caught	Its blind spots get merged
🔧 Fix	Autofix in the same PR	Cleanup PR later, if ever
📉 Codebase	Stays at your bar	Debt hits the next agent

🐛 Riskier edits: AI edits on unhealthy code carry 30%+ higher defect risk (FORGE 2026 ↗)
🪙 Costlier reads: the least healthy code takes ~45% more input tokens to read (Java / C++, SCAM 2026 ↗)

Agentic Autofix 📖 Docs

A fix PR for your backlog, not just a suggested patch.

Step	What happens
🎯 Select	Security and quality → Code quality → Standard findings. Select 1–25 findings on one page: CodeQL findings on the default branch.
🤖 Delegate	Assign to Copilot: cloud agent edits a branch, validates changes, and opens a PR. Replaces Generate fix, even for one finding.
👀 Review	Review the proposed fixes and CI results, then merge. The agent does not replace human review.

🛂 Access: Code Quality enabled on Team / Enterprise Cloud (data residency included). Existing enterprise policy; no separate bulk setting.
💳 Cost: AI credits + a Copilot license for delegation.

Enable and roll out 📖 Docs

Enablement is a three-level cascade

🏛️ Enterprise — Policies → Code quality allows organizations to use it
🏢 Organization — Settings → Code quality → Repository access picks the repositories in scope
📦 Repository — Settings → Code quality → Enable code quality turns the scans on

Before you switch it on

⚙️ GitHub Actions — deterministic CodeQL scans run as Actions workflows
🏃 Runners — GitHub-hosted, or self-hosted with the expected label
🧪 Coverage — upload Cobertura XML from your existing test workflow
🧭 Gates — start rulesets in evaluate mode, then switch to merge blocking

🏢 Rollout can only be checked per organization. The dashboard and “Repository access” are organization-scoped; the enterprise level only shows the policy allow-list and consumed licenses.

▼ gh-code-quality-inventory.sh Give it an enterprise slug: it walks every organization and reports which repositories have Code Quality enabled ./gh-code-quality-inventory.sh <enterprise>

GA availability and billing

Available on GitHub Enterprise Cloud and GitHub Team.

▸ + UNFOLDS THE DETAIL FOR THAT COST LINE

Cost	How it is measured	Good to know
💺 Base license	$10 per active committer / month. Active means a commit was pushed to an enabled repository in the last 90 days.	Product model Standalone product, complementary to GitHub Advanced Security rather than bundled with it. Not available on GitHub Enterprise Server at GA. Who counts A committer is counted once across the organization, regardless of how many repositories are enabled. GitHub App bots are excluded.
🤖 AI-powered work	AI-assisted detection and Copilot-powered features consume GitHub AI credits.	Copilot license Not required for AI-assisted detection or Autofix. Only the optional delegation of remediation to Copilot needs a Copilot license. Cap the spend Set a SKU-level budget: Enterprise → Budget → SKU = Code Quality AI credits.
⚙️ Deterministic scans	CodeQL workflows consume GitHub Actions minutes, unless self-hosted runners are used.	Cap the spend Set a GitHub Actions budget, or move the scans onto self-hosted runners.

Measure quality over time

Pull-request enforcement stops new debt. Dashboards and APIs tell you where the existing debt already lives.

📊 Repository and organization dashboards — reliability and maintainability scores across repositories, so you can see which ones carry the most debt
🧪 Coverage on pull requests — render existing Cobertura XML reports and show whether coverage improves or drops
🔌 APIs — manage repository enablement and retrieve findings for your own reporting

🎯 Dashboards tell you where quality debt lives; rulesets stop teams from adding more.